Time for me to eat some public crow: I’ve long maintained that Michigan Attorney General Dana Nessel was unrivaled among America’s most inept state attorneys general. Turns out California’s Rob Bonta is a formidable competitor.
Bonta, along with a slew of county district attorneys, announced Friday they were resolving GM’s sprawling California privacy violations for a measly $12.75 million. Here’s how Bonta framed his supposed punishment deterrent.
“General Motors sold the data of California drivers without their knowledge or consent and despite numerous statements reassuring drivers that it would not do so. This trove of information included precise and personal location data that could identify the everyday habits and movements of Californians,” Bonta said.
“Today’s settlement requires General Motors to abandon these illegal practices and underscores the importance of the data minimization in California’s privacy law — companies can’t just hold on to data and use it later for another purpose. I am proud to go to bat for the privacy rights of Californians and to collaborate with state and local partners who share the same commitment to consumer protection.”
Go to bat for the privacy rights of Californians? More like enable powerful companies to trample on them.
California’s Administrative Fee
Bonta’s self-congratulatory press release is even harder to take seriously given that GM was already under a Federal Trade Commission consent decree requiring it to stop many of the same practices addressed in the California settlement. California’s contribution was essentially to show up afterward, hold a press conference, and invoice GM for an inconsequential administrative fee.
Moreover, GM spokeswoman Charlotte McCoy told CalMatters that Bonta’s settlement addressed a product the company had already discontinued.
Bonta’s complaint alleged GM made roughly $20 million nationwide selling drivers’ data. Yet even after accusing GM of secretly monetizing sensitive geolocation and behavioral information, California extracted a penalty that does not even fully offset the nationwide revenue stream tied to the conduct.
Bonta and the district attorneys from California’s biggest counties ultimately delivered a settlement making clear they were no match for GM’s legal juggernaut. The automaker disclosed at year-end 2025 that it had already spent roughly $500 million on legal fees, investigations, and other fallout related to its alleged privacy violations.
Let me put Bonta’s $12.75 million settlement in perspective, given that GM allegedly flat out lied to a state regulator and denied it was collecting and selling driving data on unwitting Californians. GM had reason to believe dishonesty carried little legal risk. In 2024, the Department of Justice allowed GM’s driverless Cruise unit to avoid criminal prosecution after filing a false crash report with regulators, resolving the matter with a tiny $500,000 penalty.
GM CEO Mary Barra chaired Cruise’s board.
GM in 2025 posted $185 billion in revenue. The company this year earmarked $6 billion for stock buybacks. Barra in 2025 received $29.9 million in compensation, meaning California’s settlement does not even represent half her annual payday. GM President Mark Reuss earlier this year sold $38.7 million of GM stock, nearly triple the size of California’s entire settlement.
To be fair, Bonta’s GM settlement eclipsed the previous California privacy record, the $2.75 million Disney agreed to pay in February for allegedly violating state privacy laws. Notably, Barra sits on Disney’s board.
GM still faces a damning privacy violation lawsuit in Texas, where Attorney General Ken Paxton has vowed to hold companies accountable for violating the privacy rights of Lone Star State residents. Texas in August 2024 filed a sweeping lawsuit against GM alleging essentially the same privacy violations that formed the basis for California’s settlement.
Paxton is reportedly seeking a settlement well north of $1 billion from GM. That figure seems entirely credible given that Paxton previously secured a record $1.4 billion settlement with Meta, formerly Facebook, over allegations the company illegally collected and used the biometric data of millions of Texans.
The Meta settlement dwarfed the $390 million Google agreed to pay in 2022 to settle privacy claims brought collectively by 40 states.
Where GM’s Lawyers Are Actually Sweating
The litigation far more likely to keep GM’s executives awake at night is in Georgia, where a federal district judge last month allowed core claims to proceed in nationwide class action litigation alleging that GM secretly collected, shared, and monetized consumers’ driving data without proper consent.
In a 200-plus-page order issued April 22, 2026, U.S. District Judge Thomas Thrash largely denied defendants’ efforts to dismiss federal wiretap and privacy claims, finding that plaintiffs plausibly alleged GM and OnStar used connected vehicle technology to collect sensitive driving information and transmit it to third-party data brokers. OnStar is GM’s subscription-based safety, security, and connectivity service integrated into the company’s vehicles.
If GM is successfully sued for violating the Federal Wiretap Act, the automaker could be exposed to catastrophic damages. The law allows plaintiffs to seek statutory damages that can reach $10,000 per violation, a figure that becomes potentially existential when multiplied across hundreds of thousands, or even millions, of drivers whose vehicles allegedly transmitted behavioral and geolocation data without informed consent.
In Georgia, GM is facing a plaintiffs’ bar with far more financial incentive to aggressively pursue the case than California’s political class appeared to have.
Leading the litigation against GM is Amy Keller of DiCello Levitt, who along with seven partners, was named to Lawdragon’s 2026 list of the world’s top 500 plaintiff lawyers. Keller is not the sort of legal opponent GM can steamroll with a carefully choreographed settlement and a self-congratulatory press release.
Californians Weren’t Harmed?
Bonta justified the relatively tiny settlement on the grounds that California insurance law prohibits insurers from using driving data to set rates. As a result, he concluded California drivers had not suffered increased premiums because of GM’s data sales, unlike motorists in other states.
That rationale is remarkable because it implies GM turning its vehicles into rolling surveillance devices somehow becomes less serious merely because another California law prevented insurers from fully cashing in on the data.
By Bonta’s logic, the real scandal isn’t that GM harvested and sold drivers’ behavioral and location data without meaningful consent. The scandal is merely that some insurers elsewhere were able to monetize it more effectively.
Bonta’s defense of the tiny settlement becomes even shakier given his own admission that California did not determine whether GM’s geolocation data was used for other commercial purposes, including so-called “surveillance pricing,” where companies use location and behavioral data to predict what consumers are willing to pay.
In other words, California narrowed the definition of harm almost entirely to insurance premiums while openly acknowledging it had not fully explored other ways the data may have been monetized.
Still, Bonta’s disclosure that GM made only about $20 million nationwide from its surveillance activities says a great deal about the leadership of CEO Mary Barra. Spending $500 million and counting on legal fees and reputational damage tied to questionable privacy practices that generated just $20 million in revenue hardly sounds like the “disciplined execution” Barra recently boasted about on a call with analysts and reporters.
It’s telling that the corporate media has largely ignored both California’s settlement and GM’s recent legal setback in Georgia. Indeed, the only reporter I’ve seen highlight GM’s disclosure that it had already spent roughly $500 million dealing with the fallout from its privacy scandals was veteran auto reporter Phoebe Wall Howard, who spent years covering Ford.